What Are Medical Products?

From MDD to MDR, from MPG to MPDG

Until 2020, the European Medical Device Directive MDD (93/42/EEC of the Council) was superordinate to the German Medical Devices Act, which was replaced by the Medical Device Regulation MDR (EU) 2017/745. It applies without transposition into national laws since May 26, 2021. The end date of the transition period for the first placing on the market of MDD products is May 26, 2024. The MDR is assessed as a tightening of the MDD because the requirements for clinical evaluation are growing. However, the classification of products, essential requirements and conformity assessments remained. Additionally, the European In Vitro Diagnostics Regulation IVDR officially entered into force with the MDR on May 25, 2017. The IVDR has been mandatory since May 26, 2022, after a five-year transition period.

The Medical Devices Act (MPG) was replaced by the Medical Devices Law Implementation Act (MPDG) in 2020. The MPDG regulates and supplements the application of MDR (EU) 2017/745, and was introduced by Article 1 of the Medical Devices EU Adaptation Act (MPEUAnpG) of April 28, 2020.

When is a medical device compliant with the regulations? When the manufacturer proves conformity with regulations through a conformity assessment procedure. The manufacturer must affix a CE mark to the product and notify the bodies designated by law that a medical device has been placed on the market. There is no approval or certification of medical devices in Europe. Consequently, it is much easier to bring medical devices to market in Europe than in the USA, for example. There the FDA (Food and Drug Administration) oversees the approval of food, drugs and medical devices. This U.S. authority actively investigates and undertakes rigorous enforcement.

Harmonized Standards

The MDR and the MPDG define basic requirements for the safety of medical products. These requirements regarding quality, risk, usability etc. are specified in so-called harmonized standards:

The application of these standards is not mandatory. However, if they are not applied, it must be proven by other means that the medical product meets the requirements. In MDR, common specifications (CS) are also mentioned. This means that manufacturers will have to use further instruments of proof in the future.

Software as Medical Device (SaMD)

There are several distinctions made for software in medical contexts:

• software as part of a medical product, e.g. as embedded software in a medical device
• software as a standalone medical product
• Software as an accessory to a medical product
• independent software that is not a medical product

The purpose as determined by the manufacturer is decisive here. However, because this regulation is a bit vague, the Medical Device Coordination Group (MDCG) has developed a new definition of Medical Device Software (MDSW). Software as a medical device is according to this definition both software that works independently and software that makes the device work or influences its use.

Medical Product Classification

Medical products are divided into different classes taking into account the intended purpose of the devices and their inherent risks.
Article 51 of the MDR governs the allocation.

Class I: Low risk, these are divided into two groups (sterile and with measuring function). Examples: medical apps, wheelchairs, glasses, thermometers, etc.

Class IIa: Medium risk. Examples: Dental fillings, X-ray films, hearing aids, ultrasound equipment etc.

Class IIb: High risk. Examples: Intraocular lenses, condoms, X-ray equipment, infusion pumps, etc.

Class III: Very high risk. Examples: Hip and knee joint replacements, heart catheters, breast implants etc.

Classification is based on whether the product is invasive, how and for how long it is used, whether it is an active product and whether it is used on vital organs. When software is used for diagnostic or therapeutic purposes (and this is likely always to be the case), it is assigned to Class IIb or even III, depending on the risk (death or irreversible change in health status).

IEC 62304: Software for Medical Technology – Software Life Cycle Processes

Norm IEC 62304 names five software life cycle processes:

1. software development process
2. software maintenance process
3. software risk management process
4. software configuration management process
5. problem solving process for software

The software development process is divided into eight sequential steps:

Class A Injuries or damage to health cannot occur through the use of the software.

Class B Serious injuries cannot occur by using the software.

Class C Injuries including death are possible as a result of using the software.

Since 2015 there is an addendum to the standard, in which software system tests are mandatory for all classes. As far as quality and risk management in software development is concerned, this standard refers to the respective specialized standards ISO 13485 and ISO 14971. For software maintenance there is a similar plan with eight steps.

ISO 13485 Medical Products – Quality Management Systems

The standard for quality assurance of medical devices ISO 13485 is in many parts identical with the widely known quality management standard ISO 9001. The central requirement is the documentation of all processes in a quality management manual. This document also provides the basis for proof of conformity. Four process groups are defined in ISO 13485:

1. Management responsibility for defining quality objectives and monitoring the effectiveness of the quality management system.
2. Resource management (people, financial resources and equipment).
3. Product realization including development and production.
4. The process of continuous analysis and improvement.

These processes were created to ensure full compliance with the requirements for regulatory purposes. ISO 13485 is primarily aimed at the safety of medical devices, while ISO 9001 is designed to ensure that organizations strive for continuous improvement.

ISO 14971 Application of Risk Managemant to Medical Products

DIN ISO 14971 describes a risk management process for medical products. The aim is to minimize the risks for patients, users and third parties and to establish an acceptable risk-benefit ratio. The third edition of the standard, which will be published in 2019, emphasizes even more strongly that the benefits of a medical device must outweigh the risks. To this end, benefit was precisely redefined as:

positive effect or desirable outcome of the use of a medical device on the health of a person or positive impact on patient management or public health

Benefit is thus clearly defined as the medical benefit, not the economic benefit for the manufacturer.

The risk management process includes both risk analysis and risk management. This process is also divided into several steps:

1. Determination of general requirements for the risk management system
2. Risk analysis
3. Risk Assessment
4. Risk management
5. Evaluation of the total residual risk
6. Review of risk management
7. Continuous risk analysis and verification of risk acceptance in production and post-production